Selling Software in Europe: Preparing Azure for an ISO 27001:2022 Audit
Software companies expanding into the UK and the EU often find that enterprise procurement asks for ISO/IEC 27001 certification rather than, or alongside, a SOC 2 report. Here is why, what a certification auditor looks for in an Azure environment, and how Annex A technological controls can be enforced and evidenced with Azure Policy.
SOC 2 and ISO 27001 are different things
In North America, a SOC 2 Type II report is the usual evidence a buyer asks for. In the UK, the EU and the Middle East, many buyers ask for ISO/IEC 27001:2022 instead. Neither is a legal requirement in itself; they are different kinds of assurance.
A SOC 2 report is an attestation by a CPA firm against the AICPA Trust Services Criteria, describing controls the company has chosen. ISO 27001 certification is issued by an accredited certification body after it audits the company's Information Security Management System (ISMS) against the standard's clauses and the Annex A controls the company has selected in its Statement of Applicability.
The 2022 revision reorganised Annex A into four themes (organisational, people, physical and technological) and added 11 new controls. Several of them apply directly to a cloud environment:
- A.5.23 (new). Information security for use of cloud services.
- A.8.9 (new). Configuration management, including detecting drift from secure baselines.
- A.8.12 (new). Data leakage prevention across storage and messaging.
- A.8.28 (new). Secure coding, which for many teams extends to the definitions that provision infrastructure, not just application code.
Written policies are not enough on their own
Much ISO 27001 preparation focuses on the ISMS documents: scope, risk assessment, Statement of Applicability and policies. Those are required. But in the Stage 2 audit, the auditor checks that the controls are actually operating, and for a cloud environment that means questions like:
"Show me how your Azure environment prevents an engineer from deploying a resource that breaks your cloud security policy."
If the only answer is a written policy that engineers are expected to follow, it is harder to show that the control is consistently operating.
Mapping Annex A to Azure Policy
Azure Policy can enforce or audit many technological controls at management group scope. Microsoft also provides built-in ISO 27001 regulatory compliance initiatives, viewable in Microsoft Defender for Cloud, that group policy results by control. In the Compliance Guardrail Pack (Tier 2), VitCamp assigns these policies and maps each relevant Annex A control to built-in or custom policy definitions.
An illustrative mapping for A.5.23, cloud service security, might include:
| Effect | Policy |
|---|---|
| Deny | Storage accounts without infrastructure encryption enabled. |
| Audit | Virtual machines without the Microsoft Antimalware extension. |
| Deny | App Service apps that allow a minimum TLS version below 1.2. |
| Deploy if not exists | Diagnostic settings that send control-plane activity to Log Analytics. |
Giving the auditor traceable evidence
Auditor time is limited and usually billed. If the auditor has to click through the Azure portal to find evidence, the audit takes longer and is more likely to raise questions.
A Security Control Traceability Matrix (SCTM) links each in-scope Annex A control to the Azure Policy definition that supports it, the scope it is assigned at, and its current compliance state. The auditor can then pick controls from the matrix and check them directly, for example with Azure Resource Graph queries.
Where the Azure side ends
Azure Policy covers part of the technological theme. Certification still depends on the whole ISMS, on your organisational, people and physical controls, and on the certification body's own judgement. VitCamp prepares the Azure side and its evidence; the certification decision belongs to the certification body.